mirror of
https://github.com/chatmail/relay.git
synced 2026-05-15 02:14:36 +00:00
cf96be2cbb
feat: support self-signed TLS via underscore domain convention Domains starting with "_" (e.g. _chat.example.org) automatically use self-signed TLS certificates instead of ACME/Let's Encrypt. The TLS mode is derived from the domain name — no separate config option needed. Internally, when config.tls_cert_mode is "self" (underscore domain): - Generate self-signed certificates via openssl - Set Postfix smtp_tls_security_level to "encrypt" (opportunistic TLS) - Add smtp_tls_policy_map entry for underscore domains - Skip ACME, MTA-STS and www CNAME checks in `cmdeploy dns` - Serve /new via GET (not redirect to dcaccount:) with rate-limiting (nginx limit_req, 2r/s burst=5) - Return dclogin: URLs with ic=3 (AcceptInvalidCertificates) from /new - Render QR codes client-side via JavaScript and qrcode-svg - Use config.tls_cert_path/tls_key_path in Postfix, Dovecot and nginx templates instead of hardcoded ACME paths
42 lines
1.6 KiB
Python
42 lines
1.6 KiB
Python
import pytest
|
|
import requests
|
|
|
|
from cmdeploy.genqr import gen_qr_png_data
|
|
|
|
|
|
def test_gen_qr_png_data(maildomain):
|
|
data = gen_qr_png_data(maildomain)
|
|
assert data
|
|
|
|
|
|
@pytest.mark.filterwarnings("ignore::urllib3.exceptions.InsecureRequestWarning")
|
|
def test_fastcgi_working(maildomain, chatmail_config):
|
|
url = f"https://{maildomain}/new"
|
|
print(url)
|
|
verify = chatmail_config.tls_cert_mode == "acme"
|
|
res = requests.post(url, verify=verify)
|
|
assert maildomain in res.json().get("email")
|
|
assert len(res.json().get("password")) > chatmail_config.password_min_length
|
|
|
|
|
|
@pytest.mark.filterwarnings("ignore::urllib3.exceptions.InsecureRequestWarning")
|
|
def test_newemail_configure(maildomain, rpc, chatmail_config):
|
|
"""Test configuring accounts by scanning a QR code works."""
|
|
url = f"DCACCOUNT:https://{maildomain}/new"
|
|
for i in range(3):
|
|
account_id = rpc.add_account()
|
|
if chatmail_config.tls_cert_mode == "self":
|
|
# deltachat core's rustls rejects self-signed HTTPS certs during
|
|
# set_config_from_qr, so fetch credentials via requests instead
|
|
res = requests.post(f"https://{maildomain}/new", verify=False)
|
|
data = res.json()
|
|
rpc.add_or_update_transport(account_id, {
|
|
"addr": data["email"],
|
|
"password": data["password"],
|
|
"imapServer": maildomain,
|
|
"smtpServer": maildomain,
|
|
"certificateChecks": "acceptInvalidCertificates",
|
|
})
|
|
else:
|
|
rpc.add_transport_from_qr(account_id, url)
|